this policy was introduced after various issues caused at various times by people deploying containers running systemd, supervisor, and similar things